PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-33615 CyberPower CVE debrief

A path traversal vulnerability in CyberPower PowerPanel Business allows remote code execution through malicious ZIP file imports. The vulnerability, published 2024-05-02, affects versions 4.9.0 and earlier. CISA issued advisory ICSA-24-123-01 with a CVSS 3.0 score of 8.8 (HIGH). The vendor has released version 4.10.1 to address this issue. No known exploitation in ransomware campaigns has been documented.

Vendor
CyberPower
Product
PowerPanel Business
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2024-05-02
Original CVE updated
2025-08-07
Advisory published
2024-05-02
Advisory updated
2025-08-07

Who should care

Organizations using CyberPower PowerPanel Business for UPS management in data centers, critical infrastructure, and industrial environments. Security teams responsible for OT/ICS asset protection and infrastructure administrators managing power distribution systems.

Technical summary

CyberPower PowerPanel Business versions 4.9.0 and earlier contain a path traversal vulnerability (CWE-22) in their ZIP file import functionality. An attacker can craft a malicious ZIP archive containing path traversal sequences (e.g., ../) that, when extracted, write files outside the intended directory. This arbitrary file write capability can lead to remote code execution by overwriting executable files or placing malicious scripts in locations executed by the application or system. The vulnerability requires low privileges and no user interaction, with network attack vector availability.

Defensive priority

HIGH

Recommended defensive actions

  • Update CyberPower PowerPanel Business to version 4.10.1 or later
  • Restrict import functionality to authorized administrative users only
  • Implement network segmentation to limit exposure of PowerPanel Business management interfaces
  • Monitor for suspicious ZIP file uploads and unexpected file system modifications
  • Apply principle of least privilege to service accounts running PowerPanel Business
  • Review and validate backup configurations to ensure rapid recovery capability

Evidence notes

CISA CSAF advisory ICSA-24-123-01 identifies the vulnerability as a path traversal in ZIP file handling. CVSS 3.0 vector: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Affected product: CyberPower PowerPanel Business <=4.9.0. Vendor fix available: update to v4.10.1 or later. Advisory revised 2024-05-06 to add CVSS scores and 2025-08-07 to update CWE classification.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-33615 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-33615

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-33615 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-33615

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-123-01.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-123-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.